diff --git a/evtx/Maps/Microsoft-Windows-Windows-Firewall-With-Advanced-Security-Firewall_Microsoft-Windows-Windows-Firewall-With-Advanced-Security_2004.map b/evtx/Maps/Microsoft-Windows-Windows-Firewall-With-Advanced-Security-Firewall_Microsoft-Windows-Windows-Firewall-With-Advanced-Security_2004.map
index dc608ba5..979d82c9 100644
--- a/evtx/Maps/Microsoft-Windows-Windows-Firewall-With-Advanced-Security-Firewall_Microsoft-Windows-Windows-Firewall-With-Advanced-Security_2004.map
+++ b/evtx/Maps/Microsoft-Windows-Windows-Firewall-With-Advanced-Security-Firewall_Microsoft-Windows-Windows-Firewall-With-Advanced-Security_2004.map
@@ -53,6 +53,12 @@ Maps:
         Name: Protocol
         Value: "/Event/EventData/Data[@Name=\"Protocol\"]"
 Lookups:
+  -
+    Name: Direction
+    Default: Unknown code
+    Values:
+      1: Inbound
+      2: Outbound
   -
     Name: Action
     Default: Unknown code
diff --git a/evtx/Maps/Microsoft-Windows-Windows-Firewall-With-Advanced-Security-Firewall_Microsoft-Windows-Windows-Firewall-With-Advanced-Security_2005.map b/evtx/Maps/Microsoft-Windows-Windows-Firewall-With-Advanced-Security-Firewall_Microsoft-Windows-Windows-Firewall-With-Advanced-Security_2005.map
index a545c90a..31993333 100644
--- a/evtx/Maps/Microsoft-Windows-Windows-Firewall-With-Advanced-Security-Firewall_Microsoft-Windows-Windows-Firewall-With-Advanced-Security_2005.map
+++ b/evtx/Maps/Microsoft-Windows-Windows-Firewall-With-Advanced-Security-Firewall_Microsoft-Windows-Windows-Firewall-With-Advanced-Security_2005.map
@@ -53,6 +53,12 @@ Maps:
         Name: Protocol
         Value: "/Event/EventData/Data[@Name=\"Protocol\"]"
 Lookups:
+  -
+    Name: Direction
+    Default: Unknown code
+    Values:
+      1: Inbound
+      2: Outbound
   -
     Name: Action
     Default: Unknown code